NetBSD Problem Report #53860
From www@NetBSD.org Fri Jan 11 22:29:13 2019
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 825017A172
for <gnats-bugs@gnats.NetBSD.org>; Fri, 11 Jan 2019 22:29:13 +0000 (UTC)
Message-Id: <20190111222911.F3AD47A1F8@mollari.NetBSD.org>
Date: Fri, 11 Jan 2019 22:29:11 +0000 (UTC)
From: venture37@geeklan.co.uk
Reply-To: venture37@geeklan.co.uk
To: gnats-bugs@NetBSD.org
Subject: system panics when interacting the rtwn(4) wifi interface
X-Send-Pr-Version: www-1.0
>Number: 53860
>Category: kern
>Synopsis: system panics when interacting the rtwn(4) wifi interface
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Jan 11 22:30:00 +0000 2019
>Last-Modified: Thu Jun 25 11:30:01 +0000 2020
>Originator: Sevan Janiyan
>Release: NetBSD-HEAD
>Organization:
>Environment:
NetBSD 8.99.30 (GENERIC) #0: Tue Jan 8 04:18:50 UTC 2019 amd64
>Description:
rtwn0 at pci2 dev 0 function 0: vendor 10ec product 8178 (rev. 0x01)
rtwn0: interrupting at msi3 vec 0
rtwn0: MAC/BB RTL8192CE, RF 6052 2T2R, address 6c:71:d9:
rtwn0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
rtwn0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
System panicked: kernel diagnostic assertion "(!cpu_intr_p() && !cpu_softintr_p()) || (pc->pc_pool.pr_ipl != IPL_NONE || cold || panicstr != NULL)" failed: file "/usr/src/sys/kern/subr_pool.c", line 2312 pool_cache_get_paddr: [pnbufpl] is IPL_NONE, but called from interrupt context
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
?() at ffff9080ade056d0
vpanic() at vpanic+0x178
ch_voltag_convert_in() at ch_voltag_convert_in
pool_cache_get_paddr() at pool_cache_get_paddr+0x149
firmware_open() at firmware_open+0x54
rtwn_init() at rtwn_init+0xd23
rtwn_init_task() at rtwn_init_task+0x50
softint_dispatch() at softint_dispatch+0xee
DDB lost frame for Xsoftintr+0x4f, trying 0xffff9080ade110f0
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
9124aaffe8b1f6a9:
crash> ps
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
419 1 2 0 8020000 ffffd82557927500 wpa_supplicant
409 1 2 3 8020000 ffffd82553eff0c0 ksh
401 1 2 1 8020000 ffffd825548330a0 getty
391 1 2 2 8020000 ffffd82556e288c0 getty
413 1 2 3 8020000 ffffd825548338e0 getty
394 1 2 0 8020000 ffffd82558394840 login
85 1 2 0 8020000 ffffd8242da9f780 cron
364 1 2 1 8020000 ffffd82556e28080 inetd
326 > 1 7 2 8020000 ffffd825548334c0 wsmoused
315 1 2 3 8020000 ffffd8255784e480 powerd
156 > 1 7 1 8020000 ffffd8255784e060 syslogd
114 > 1 7 3 8020000 ffffd824328fe460 mdnsd
1 1 2 1 8020000 ffffd8242bfa4720 init
0 94 3 0 200 ffffd8242be0c1e0 physiod physiod
0 93 3 2 200 ffffd8242da9f360 intelfb intelfb
0 91 3 0 200 ffffd8242da9fba0 aiodoned aiodoned
0 90 3 3 200 ffffd824318d5340 ioflush syncer
0 89 3 2 200 ffffd824318d5760 pgdaemon pgdaemon
0 88 3 2 200 ffffd824318d5b80 i915-hangcheck i915-hangcheck
0 87 3 2 200 ffffd8242c018320 i915-dp i915-dp
0 86 3 2 200 ffffd8242c018740 i915 i915
0 82 3 2 200 ffffd8242beba200 usb3 usbevt
0 81 3 0 200 ffffd8242beba620 usb2 usbevt
0 80 3 2 200 ffffd8242bebaa40 usb1 usbevt
0 79 3 2 200 ffffd8242bec1640 usb0 usbevt
0 78 3 3 200 ffffd8242c018b60 acpibat1 acpibat1
0 77 3 2 200 ffffd8242be0c600 acpibat0 acpibat0
0 76 3 2 200 ffffd8242bfa4300 npfgc-0 npfgccv
0 75 3 2 200 ffffd8242bfa4b40 rt_free rt_free
0 74 3 2 200 ffffd8242bf7d2e0 unpgc unpgc
0 73 3 3 200 ffffd8242bf7d700 key_timehandler key_timehandler
0 72 3 3 200 ffffd8242bf7db20 icmp6_wqinput/3 icmp6_wqinput
0 71 3 2 200 ffffd8242bfa72c0 icmp6_wqinput/2 icmp6_wqinput
0 70 3 1 200 ffffd8242bfa76e0 icmp6_wqinput/1 icmp6_wqinput
0 69 3 0 200 ffffd8242bfa7b00 icmp6_wqinput/0 icmp6_wqinput
0 68 3 2 200 ffffd8242bf5f2a0 nd6_timer nd6_timer
0 67 3 3 200 ffffd8242bf5f6c0 icmp_wqinput/3 icmp_wqinput
0 66 3 2 200 ffffd8242bf5fae0 icmp_wqinput/2 icmp_wqinput
0 65 3 1 200 ffffd8242bf48280 icmp_wqinput/1 icmp_wqinput
0 64 3 0 200 ffffd8242bf486a0 icmp_wqinput/0 icmp_wqinput
0 63 2 1 200 ffffd8242bf48ac0 rt_timer
0 62 3 2 200 ffffd8242bef1260 vmem_rehash vmem_rehash
0 61 3 2 200 ffffd8242bef1680 coretemp1 coretemp1
0 60 3 0 200 ffffd8242bef1aa0 coretemp0 coretemp0
0 59 3 0 200 ffffd8242beea240 acpitz1 acpitz1
0 58 3 2 200 ffffd8242beea660 acpitz0 acpitz0
0 57 3 1 200 ffffd8242bec1220 thinkpad0 thinkpad0
0 56 3 0 200 ffffd8242beeaa80 sdmmc0 mmctaskq
0 47 2 1 200 ffffd8242be0ca20 iic0
0 46 3 3 200 ffffd8242bdd51c0 atabus2 atath
0 45 3 2 200 ffffd8242bdd55e0 atabus1 atath
0 44 2 0 200 ffffd8242bdd5a00 atabus0
0 43 3 3 280 ffffd8242bb7e1a0 audiomix play
0 42 3 2 280 ffffd8242bb7e5c0 audiorec record
0 41 3 0 200 ffffd8242bb7e9e0 usbtask-dr usbtsk
0 40 3 0 200 ffffd8242bb20180 usbtask-hc usbtsk
0 39 3 0 200 ffffd8242bb205a0 pms0 pmsreset
0 38 3 0 200 ffffd8242bb209c0 acpiec sci thre ecsci
0 37 3 3 200 ffffd8242ba90160 xcall/3 xcall
0 36 1 3 200 ffffd8242ba90580 softser/3
0 35 1 3 200 ffffd8242ba909a0 softclk/3
0 34 1 3 200 ffffd8242ba71140 softbio/3
0 33 1 3 200 ffffd8242ba71560 softnet/3
0 32 1 3 201 ffffd8242ba71980 idle/3
0 31 3 2 200 ffffd8242ba27120 xcall/2 xcall
0 30 1 2 200 ffffd8242ba27540 softser/2
0 29 3 2 200 ffffd8242ba27960 softclk/2 tstile
0 28 1 2 200 ffffd8242ba20100 softbio/2
0 27 1 2 200 ffffd8242ba20520 softnet/2
0 26 1 2 201 ffffd8242ba20940 idle/2
0 25 3 1 200 ffffd8242b9d70e0 xcall/1 xcall
0 24 1 1 200 ffffd8242b9d7500 softser/1
0 23 1 1 200 ffffd8242b9d7920 softclk/1
0 22 1 1 200 ffffd8242b9c20c0 softbio/1
0 21 1 1 200 ffffd8242b9c24e0 softnet/1
0 20 1 1 201 ffffd8242b9c2900 idle/1
0 19 3 1 200 ffffd825585860a0 lnxpwrwq lnxpwrwq
0 18 3 2 200 ffffd825585864c0 lnxlngwq lnxlngwq
0 17 3 1 200 ffffd825585868e0 lnxsyswq lnxsyswq
0 16 3 1 200 ffffd825585a9080 lnxrcugc lnxrcugc
0 15 3 2 200 ffffd825585a94a0 sysmon smtaskq
0 14 3 1 200 ffffd825585a98c0 pmfsuspend pmfsuspend
0 13 3 1 200 ffffd825589bc060 pmfevent pmfevent
0 12 3 0 200 ffffd825589bc480 sopendfree sopendfr
0 11 3 1 200 ffffd825589bc8a0 nfssilly nfssilly
0 10 2 1 200 ffffd82559de5040 cachegc
0 9 3 0 200 ffffd82559de5460 vdrain vdrain
0 8 3 0 200 ffffd82559de5880 modunload mod_unld
0 7 3 0 200 ffffd82559df8020 xcall/0 xcall
0 6 1 0 200 ffffd82559df8440 softser/0
0 > 5 7 0 200 ffffd82559df8860 softclk/0
0 4 1 0 200 ffffd82559e1b000 softbio/0
0 > 3 7 0 200 ffffd82559e1b420 softnet/0
0 > 2 7 0 201 ffffd82559e1b840 idle/0
0 1 3 0 200 ffffffff816574a0 swapper uvm
>How-To-Repeat:
ifconfig rtwn0 up && ifconfig rtwn0 list scan
or point wpa_supplicant at it
>Fix:
>Audit-Trail:
From: Sevan Janiyan <venture37@geeklan.co.uk>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: kern/53860: system panics when interacting the rtwn(4) wifi
interface
Date: Sat, 12 Jan 2019 02:36:49 +0000
The assert is his hit from
https://nxr.netbsd.org/xref/src/sys/dev/firmload.c#224
PNBUF_GET is defined to pool_cache_get which is defined to
pool_cache_get_paddr
https://nxr.netbsd.org/xref/src/sys/kern/subr_pool.c#pool_cache_get_paddr
Sevan
From: Sevan Janiyan <venture37@geeklan.co.uk>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: kern/53860: system panics when interacting the rtwn(4) wifi
interface
Date: Sat, 12 Jan 2019 02:40:43 +0000
On 12/01/2019 02:36, Sevan Janiyan wrote:
> The assert is his hit from
> https://nxr.netbsd.org/xref/src/sys/dev/firmload.c#224
firmware_open is called in rtwn_load_firmware() by rtwn_init()
https://nxr.netbsd.org/xref/src/sys/dev/pci/if_rtwn.c#3356
From: "Jukka Ruohonen" <jruoho@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/53860 CVS commit: src/tests/sbin/ifconfig
Date: Thu, 25 Jun 2020 11:26:05 +0000
Module Name: src
Committed By: jruoho
Date: Thu Jun 25 11:26:05 UTC 2020
Modified Files:
src/tests/sbin/ifconfig: t_repeated_scan.sh
Log Message:
Reference also PR kern/53860.
To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 src/tests/sbin/ifconfig/t_repeated_scan.sh
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(Contact us)
$NetBSD: query-full-pr,v 1.46 2020/01/03 16:35:01 leot Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2020
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.